Zcash says Ironwood proof rules out undetectable counterfeiting bugs

QWhat is the main security property formally verified for Ironwood, and what does it guarantee?

AThe main security property formally verified for Ironwood is 'balance integrity'. It guarantees that the shielded pool cannot pay out more value than has publicly entered it, ruling out undetectable counterfeiting under the stated cryptographic assumptions.

QWhat was the catalyst for the development of the Ironwood shielded pool in Zcash?

AIronwood was developed and introduced through Zcash's NU6.3 upgrade in direct response to a vulnerability discovered in the older Orchard shielded pool, which could theoretically have enabled undetectable ZEC counterfeiting. It was designed to restore confidence in Zcash's supply integrity.

QHow was the formal verification proof for Ironwood created and how extensive was it?

AThe formal verification proof was written in the Lean programming language. It comprises over 2,700 theorems and took three separate teams of researchers and cryptographers over a month to complete.

QDoes the formal verification proof cover Ironwood's privacy guarantees? What components does it primarily cover?

ANo, the proof does not cover Ironwood's separate privacy guarantees. It primarily covers the components needed for the balance integrity property, including Ironwood’s zero-knowledge proof system, circuit rules, and ledger-level accounting.

QWhat mechanism is used to ensure funds migrating from the old Orchard pool to Ironwood cannot introduce counterfeit coins?

AFunds migrating from the Orchard pool to Ironwood must pass through a public accounting checkpoint called a 'turnstile'. This mechanism is designed to prevent any hypothetical excess or counterfeit coins from the old pool from entering the new Ironwood shielded pool.